Find broken authorization before attackers do.
What it does
Tests applications and APIs for IDOR, BOLA, BFLA, and related authorization flaws.
When to use it
Use when requests expose identifiers, tenant boundaries, writable fields, or potentially missing object-level authorization.
How to use it
Give it an application or API; it systematically tests cross-account authorization and reports evidence of confirmed access.
What you provide
- the application or API to test
Good to know
- cannot be undone: application under test
Latest review
What you need · 1
The workflow authenticates as UserB and uses that session token to replay UserA's requests.
Access · 1
This skill
application under test
Write
Modifies other users' data (irreversible)